• SonicOS 7
• Interfaces
  • About Interfaces
    • Physical and Virtual Interfaces
      • Physical Interfaces
      • Virtual Interfaces (VLAN)
      • Subinterfaces
    • SonicOS Secure Objects
    • One Arm Mode and Single Interface Support
    • Transparent Mode
    • IPS Sniffer Mode
      • Sample IPS Sniffer Mode Topology
    • Firewall Sandwich
    • HTTP/HTTPS Redirection
      • HTTP/HTTPS Redirection with DP Offload
    • Enabling DNS Proxy on an Interface
    • LTE Modem Support
    • LAN Bypass
  • Interface Settings IPv4
    • Adding Virtual Interfaces
      • Configuring General Settings for Virtual Interface
      • Configuring Advanced Settings for a Virtual Interface
      • Configuring Virtual Interfaces (VLAN Subinterfaces)
    • Configuring Routed Mode
    • Enabling Bandwidth Management on an Interface
    • Configuring Interfaces in Transparent IP Mode (Splice L3 Subnet)
      • Configuring Advanced Settings for a Transparent IP Mode Interface
    • Configuring Wireless Interfaces
      • Configuring Advanced Settings for a Wireless Interface
    • Configuring WAN Interfaces
      • Configuring Advanced Settings for a WAN Interface
      • Configuring Protocol Settings for a WAN Interface
    • Configuring Tunnel Interfaces
    • Configuring VPN Tunnel Interfaces
    • Configuring Link Aggregation and Port Redundancy
      • Link Aggregation
        • Link Aggregation Failover
        • Link Aggregation Limitations
        • Link Aggregation Configuration
      • Port Redundancy
        • Port Redundancy Failover
        • Port Redundancy Configuration
    • Configuring One Arm Mode
    • Configuring an IPS Sniffer Mode Appliance
      • Configuration Task List for IPS Sniffer Mode
      • Configuring the Primary Bridge Interface
      • Configuring the Secondary Bridge Interface
      • Configuring SNMP
      • Configuring IPS Sniffer Mode
    • Configuring Security Services (Unified Threat Management)
      • Configuring Logging
      • Connecting a Mirrored Switch Port to an IPS Sniffer Mode Interface
      • Connecting and Configuring a WAN Interface to the Data Center
    • Configuring Wire and Tap Mode
      • Configuring an Interface for Wire Mode
      • Configuring Wire Mode for a WAN/LAN Zone Pair
      • Configuring Wire Mode with Link Aggregation
    • Layer 2 Bridged Mode
      • Key Features of SonicOS Layer 2 Bridged Mode
      • Key Concepts to Configuring L2 Bridged Mode and Transparent Mode
      • Comparing L2 Bridged Mode to Transparent Mode
        • Comparison of L2 Bridged Mode to Transparent Mode
        • Benefits of Transparent Mode over L2 Bridged Mode
        • ARP in Transparent Mode
        • VLAN Support in Transparent Mode
        • Multiple Subnets in Transparent Mode
        • Non-IPv4 Traffic in Transparent Mode
        • ARP in L2 Bridged Mode
        • VLAN Support in L2 Bridged Mode
        • L2 Bridge IP Packet Path
        • Multiple Subnets in L2 Bridged Mode
        • Non-IPv4 Traffic in L2 Bridged Mode
      • L2 Bridge Path Determination
      • L2 Bridge Interface Zone Selection
        • Security Services Directionality
        • Access Rule Defaults
        • WAN Connectivity
      • Sample Topologies
        • Wireless Layer 2 Bridge
        • Inline Layer 2 Bridged Mode
        • Perimeter Security
        • Internal Security
        • Layer 2 Bridged Mode with High Availability
        • Layer 2 Bridged Mode with SSL VPN
        • WAN to LAN Access Rules
      • Configuring Network Interfaces and Activating L2B Mode
        • Installing the Appliance between the Network and an SSL VPN Appliance
        • Configuring or Verifying Settings
      • Configuring Layer 2 Bridged Mode
        • Configuration Task List for Layer 2 Bridged Mode
        • Configuring the Common Settings for L2 Bridged Mode Deployments
          • Licensing Services
          • Disabling a DHCP Server
          • Configuring SNMP Settings
          • Enabling SNMP and HTTPS on the Interfaces
          • Enabling Syslog
          • Activating Security Services on Each Zone
          • Creating Access Rules
          • Configuring Log Settings
          • Configuring Wireless Zone Settings
        • Configuring Layer 2 Bridged Mode Procedure
          • Configuring the Primary Bridge Interface
          • Configuring the Secondary Bridge Interface
          • Configuring an L2 Bypass for Hardware Failures
        • VLAN Integration with Layer 2 Bridged Mode
        • VPN Integration with Layer 2 Bridged Mode
      • Asymmetric Routing
    • Configuring Interfaces for IPv6
  • 31-Bit Network Settings
    • 31-Bit Network Environment Example
    • Configuring a 31-Bit Network in SonicOS
  • PPPoE Unnumbered Interface Support
    • Sample Network Topography
    • Caveats
    • Configuring a PPPoE Unnumbered Interface
    • Configuring HA with PPPoE Unnumbered
• Failover & LB
  • Settings
  • Groups
• Neighbor Discovery
  • Static NDP Entries
    • Adding Static NDP Entries
    • Editing Static NDP Entries
    • Deleting Static NDP Entries
  • NDP Settings
  • NDP Cache
    • Flushing the NDP Cache
• ARP
  • Static ARP Entries
    • Viewing Static ARP Entries
    • Adding Static ARP Entries
    • Editing Static ARP Entries
    • Deleting Static ARP Entries
    • Secondary Subnets with Static ARP
      • Adding a Secondary Subnet
        • Secondary Subnet Example
  • ARP Settings
  • ARP Cache
    • Flushing the ARP Cache
• MAC IP Anti-Spoof
  • MAC IPv4 and IPv6 Anti-Spoof Settings
  • Configuring MAC IP Anti-Spoof Settings
  • Anti-Spoof Cache
  • Spoof Detected List
• Web Proxy
  • User Proxy Servers
  • Automatic Proxy Forwarding (Web Only)
    • Adding User Proxy Servers
    • Editing User Proxy Servers
    • Deleting User Proxy Servers
• PortShield Groups
  • Static and Transparent Mode
    • Working in Static Mode
    • Working in Transparent Mode
  • SonicOS Support of X-Series Switches
    • About the X-Series Solution
    • Performance Requirements
    • Key Features Supported with X-Series Switches
    • PortShield Functionality and X-Series Switches
      • Different Traffic Scenarios with PortShield
      • Prerequisites for PortShielding X-Series Switches
      • Dell X-Series Daisy-Chaining Support
        • Assumptions and Dependencies
        • Daisy-chaining Support
    • PoE/PoE+ and SFP/SFP+ Support
    • X-Series Solution and SonicPoints
    • Managing Extended Switches using GMS
    • Extended Switch Global Parameters
    • About Links
      • About Uplink Interfaces
      • Criteria for Configuring an Uplink Interface
    • Logging and Syslog Support
  • Supported Topologies
  • Port Graphics
  • Port Configuration
  • External Switch Configuration
  • External Switch Diagnostics
    • Switch Information
    • Statistics
    • Firmware Management
  • Configuring PortShield Groups
    • Configuring PortShield Interfaces on NETWORK | System > Interfaces
    • Configuring PortShield Interfaces with the PortShield Interface Guide (TZ Series Firewalls Only)
    • Configuring PortShield Interfaces on NETWORK | System > PortShield Groups
    • Configuring External Switch PortShield Groups from Port Graphics
• VLAN Translation
  • Mapping Modes
  • Mapping Persistence
  • Map Multiple Interface Pairs
  • Creating and Managing VLAN Maps
    • Creating a VLAN Map
      • Creating a Wire Mode Pair in Secure Mode
      • Creating the VLAN Mapping
    • Managing VLAN Mappings
      • Editing Mappings
      • Filtering Mappings
      • Deleting Mappings
• IP Helper
  • Using IP Helper
    • About IP Helper
      • VPN Tunnel Interface Support for IP Helper
      • DHCPv6 Relay
        • About DHCPv6 Relay
        • Configuring DHCPv6 Relay
    • IP Helper Settings
      • Relay Protocols
      • Policies
      • DHCP/DHCPv6 Relay Leases
  • Configuring IP Helper
    • Enabling IP Helper
    • Managing Relay Protocols
      • Adding User-Defined Relay Protocols
      • Deleting Custom Protocols
    • Managing IP Helper Policies
      • Adding an IP Helper Policy
      • Editing an IP Helper Policy
      • Deleting IP Helper Policies
    • Filtering Which DHCP Relay Leases are Displayed
    • Displaying IP Helper Cache from TSR
• Dynamic Routing
  • Route Advertisement
  • OSPFv2
  • OSPFv3
  • RIP
  • RIPng
  • Settings
• DHCP Server
  • Configuring a DHCP Server
    • Configuring the DHCP Server Settings
      • Configuring the DHCP Server for DNS Proxy
    • Configuring DHCP Server Lease Scopes
    • Current DHCP Leases
      • Current DHCP Leases IPv4
      • Current DHCP Leases IPv6
    • DHCPv6 Relay
  • Configuring Advanced Options
    • Configuring DHCP Option Objects
    • Configuring DHCP Option Groups
    • Configuring a Trusted DHCP Relay Agent Address Group (IPv4 Only)
    • Enabling Trusted DHCP Relay Agents
    • Configuring IPv4 DHCP Servers for Dynamic Ranges
      • Add DHCP Dynamic Scope
      • DNS/WINS
      • Advanced
    • Configuring IPv6 DHCP Servers for Dynamic Ranges
      • Add DHCPv6 Dynamic Scope
      • DNS
      • Advanced
    • Configuring IPv4 DHCP Static Ranges
      • Adding DHCPv4 Static Scope Settings
    • Configuring IPv6 DHCP Static Ranges
    • Configuring DHCP Generic Options for DHCP Lease Scopes
      • RFC-defined DHCP Option Numbers
    • DHCP and IPv6
• Multicast
  • Multicast Policies
    • Creating a Multicast Address Object
    • Creating a New Multicast Address Group
  • IGMP State
  • Enabling Multicast
    • Enabling Multicast on a LAN-Dedicated Interface
    • Enabling Multicast Support for Address Objects over a VPN Tunnel
• Network Monitor
  • About Network Monitor Policies
  • Configuring Network Monitor Policies
  • Deleting Network Monitor Policies
• AWS Configuration
  • AWS Security Credentials
    • IAM Group and User
  • Firewall Configuration
    • Test Connection
• SonicWall Support
  • About This Document

Configuring MAC IP Anti-Spoof Settings

To configure settings for a particular interface, click the Edit icon in the Configure column for the desired interface. The Edit Interface dialog is displayed for the selected interface.

The following options are available:

• Anti-Spoof Settings
  • Enable MAC-IP based anti-spoofing: To enable the MAC-IP Anti-Spoof subsystem on traffic through this interface
  • Static ARP: Allows the Anti-Spoof cache to be built from static ARP entries
  • DHCP Server: Allows the Anti-Spoof cache to be built from active DHCP leases from the SonicWall DHCP server
  • DHCP Relay: Allows the Anti-Spoof cache to be built from active DHCP leases, from the DHCP relay, based on IP Helper
• ARP Settings
  • ARP Lock: Locks ARP entries for devices listed in the MAC-IP Anti-Spoof cache. This applies egress control for an interface through the MAC-IP Anti-Spoof configuration, and adds MAC-IP cache entries as permanent entries in the ARP cache. This controls ARP poisoning attacks, as the ARP cache is not altered by illegitimate ARP packets.
  • ARP Watch: Prevents ARP poisoning of connected machines to protect all clients’ PCs from man-in-the-middle attacks.
• Miscellaneous Settings
  • Enforce Ingress anti-spoof: Enables ingress control on the interface, blocking traffic from devices not listed in the MAC-IP Anti-Spoof Cache.
  • Spoof Detection: Logs all devices that fail to pass Anti-spoof cache and lists them in the Spoof Detected List.
  • Allow Management: Allows through all packets destined for the appliance’s IP address, even if coming from devices currently not listed in the Anti-Spoof Cache.

After your setting selections for this interface are complete, click Save. After the settings have been adjusted, the interface’s listing is updated on the MAC-IP Anti-Spoof page. The green circle with white check mark icons denote which settings have been enabled.

The following interfaces are excluded from the MAC-IP Anti-Spoof list:

• Non-Ethernet interfaces
• Port-shield member interfaces
• Layer 2 bridge pair interfaces
• High availability interfaces
• High availability data interfaces